Vulnerabilities > Mantisbt
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-04-13 | CVE-2022-26144 | Cross-site Scripting vulnerability in Mantisbt An XSS issue was discovered in MantisBT before 2.25.3. | 6.1 |
| 2021-06-17 | CVE-2021-33557 | Cross-site Scripting vulnerability in Mantisbt An XSS issue was discovered in manage_custom_field_edit_page.php in MantisBT before 2.25.2. | 6.1 |
| 2021-03-07 | CVE-2009-20001 | Insufficient Session Expiration vulnerability in Mantisbt An issue was discovered in MantisBT before 2.24.5. | 8.1 |
| 2021-02-22 | CVE-2020-35571 | Cross-site Scripting vulnerability in Mantisbt An issue was discovered in MantisBT through 2.24.3. | 6.1 |
| 2021-01-29 | CVE-2020-29605 | Incorrect Authorization vulnerability in Mantisbt An issue was discovered in MantisBT before 2.24.4. | 4.3 |
| 2021-01-29 | CVE-2020-29604 | Missing Authorization vulnerability in Mantisbt An issue was discovered in MantisBT before 2.24.4. | 6.5 |
| 2021-01-29 | CVE-2020-29603 | Insecure Storage of Sensitive Information vulnerability in Mantisbt In manage_proj_edit_page.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manage_proj_edit_page.php project_id parameter, without having access to them. | 4.3 |
| 2021-01-18 | CVE-2020-36192 | Unspecified vulnerability in Mantisbt Source Integration An issue was discovered in the Source Integration plugin before 2.4.1 for MantisBT. | 5.3 |
| 2020-12-30 | CVE-2020-28413 | SQL Injection vulnerability in Mantisbt 2.24.3 In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the API SOAP. | 6.5 |
| 2020-12-30 | CVE-2020-35849 | Authorization Bypass Through User-Controlled Key vulnerability in Mantisbt An issue was discovered in MantisBT before 2.24.4. | 7.5 |